Your router calls it "Unknown device" at 192.168.1.23; Vedetta calls it the kitchen light and shows its work. Vedetta is a Home Assistant app that scans your local network, identifies what each device actually is, and explains every identification. One scan lists every device it can find with presence and latency history, in tile or list view, light or dark, on a computer or a phone. Behind each name sits the recognition engine: it weighs many weak clues together, counts a repeated fact once, groups devices by family, and shows certainty honestly, keeping anything doubtful in Other rather than inventing a label. Tap the info marker beside a name, brand, or type and a pop-up lists every clue, its weight, and the hypotheses that were rejected. Names or rooms you set by hand are never overwritten by later scans, and sleeping phones are remembered instead of flickering in and out. Choose from three search levels depending on how hard you want it to probe, let the nightly deep search refresh the picture, and use the network doctor to spot duplicate addresses, repeated restarts, devices that drop together, or a slowing gateway. It can also publish what you choose to Home Assistant and MQTT, display devices from other networks your Home Assistant already sees, and mask exports before they leave the machine. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

PrivateBin shares text and files with true zero-knowledge encryption: the server stores only ciphertext it cannot decrypt because the key exists exclusively in the URL fragment that never reaches the server. With over 8,400 GitHub stars and 500,000+ Docker pulls, it has become the standard for privacy-respecting paste sharing where not even the hosting operator can read stored content. All encryption uses 256-bit AES in Galois Counter mode performed entirely client-side in the browser. Burn-after-reading mode destroys pastes on first view, while configurable expiration timers automatically purge content after periods ranging from five minutes to forever. Optional password protection adds a second encryption layer requiring recipients to enter a passphrase before decryption occurs. Discussion threads enable anonymous or nickname-based commenting on pastes with IP-based identicon avatars for visual identity. Markdown rendering with live preview formats pastes as styled HTML, and syntax highlighting through prettify.js supports dozens of programming languages across four color themes. File upload support enables sharing images, PDFs, and media files with in-browser preview. QR code generation converts paste URLs for mobile device transfer. Customizable templates include Bootstrap 5, classic Bootstrap CSS, and Darkstrap themes. Storage backends support filesystem, MySQL, PostgreSQL, SQLite, Amazon S3, and Google Cloud Storage. Deploy via Docker with the privatebin/nginx-fpm-alpine image on port 8080. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. zlib licensed.

FlyBudget gives every dollar a job and keeps your financial data on a server you control, with no subscription, no account, and no tracking. Plan each month by category with carry-over, and watch bars turn amber near the plan and red when you overspend. Write a rule in plain words, preview the past transactions it matches, and let it rename, categorize, or split everything that arrives next. Track checking, credit cards, loans, investments, and property in their own currencies, then reconcile when the numbers need proof. Import CSV files from any bank with duplicate detection, or connect SimpleFIN or Plaid for automatic sync. Bills, subscriptions, and paychecks appear as a list or calendar, and FlyBudget can find them in your history. Dashboards of net worth, spending, trends, and cash flow can be rearranged, and a custom report builder covers the rest. Savings goals, payees with logos, and one-step backups sit alongside light and dark themes. Every page has a phone layout, and transactions entered offline sync when the connection returns. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Diaspora lets you run your own social network node that federates with thousands of others, creating a network with no central authority and no advertising engine mining your behavior. The defining feature is aspect-based sharing: organize contacts into groups like Family, Work, and Close Friends, then control exactly who sees each post with granularity that mainstream platforms have never matched. Hashtag-based discovery connects conversations across the entire federation regardless of which pod participants call home, building communities around topics rather than algorithmic engagement bait. The Ruby on Rails backend (now running on Puma with Sidekiq workers instead of the heavier Unicorn configuration) handles federation delivery, media processing, and notifications efficiently. Photo albums, video embedding, Markdown posts, mentions, reactions, and resharing provide familiar social primitives for rich communication. Cross-posting bridges to Twitter and Tumblr maintain your presence on legacy networks while your canonical data lives on your own infrastructure. With 13,700+ GitHub stars and 270+ contributors since its 2010 launch, Diaspora proved early that social media can work without surveillance capitalism. The Docker Compose deployment runs the application alongside PostgreSQL, Redis, Sidekiq workers, and Nginx, providing a production-ready pod for your community.

Friends drift away when nobody remembers to call; Meerkat CRM is a self-hosted personal CRM that keeps your relationships warm with birthday and stay in touch reminders, contact notes, and a living map of who knows whom. Organize every contact into circles like family, friends, or work, store spouses and children as linked relationships, and see the whole crowd on an interactive network graph that shows how people connect. Sync the same address book two ways: Meerkat runs its own CardDAV server for your phone and can also act as a CardDAV client against an external server you already use. Against each person you can keep the details that matter, dietary habits, kids names, the last conversation, plus a social style timeline of activities you have shared, from dinners to group projects. Reminders nudge you by email when it has been too long, with upcoming birthdays surfaced on the dashboard, so catching up becomes a habit instead of an afterthought. Move data in and out freely: import CSV, VCF, and even a Monica export, export back to CSV and VCF, connect external calendars, and fire webhooks into your own automations. Use it in English, German, Italian, Spanish, or French with light and dark modes, and SSO for whoever shares the house. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Real LibreOffice document engineering in the browser: Collabora Online is built by the company employing much of the former SUSE LibreOffice team - not a reimplementation. This deployment runs CODE (Collabora Online Development Edition), the collabora/code server that renders and edits documents entirely server-side while browsers get high-fidelity WYSIWYG output, so layout and formatting survive round-trips that break lesser converters. Four editors ship in one container: Writer for text documents (comments, track changes with comparison and restoration, form handling), Calc for spreadsheets (advanced formulas, macros, pivot tables, per-user sheet views, server-enforced cell protection), Impress for presentations, and Draw for Visio-class diagrams. Format compatibility spans DOCX, XLSX, PPTX, the ODF family, PDF, and dozens more - including Visio and Publisher import. Real-time collaborative editing supports multiple simultaneous editors with visible cursors and commenting. The architectural point: documents are processed on your server and never leave it, which is why Collabora is the engine behind Nextcloud Office and integrates with ownCloud, Seafile, and any WOPI-speaking host - or embeds in your own application via the SDK. An admin console monitors sessions and memory. For organizations that need Google Docs-style collaboration with actual data sovereignty, this is the reference open-source answer.

Upload files, get a share link, let it expire: PsiTransfer is a self-hosted WeTransfer with no accounts, no logins, and no third-party cloud with size caps and metadata harvesting. The engineering focus is large files over imperfect networks. Uploads use the tus.io resumable protocol, so a dropped connection on a multi-gigabyte video resumes exactly where it stopped once you're back online; downloads support HTTP range headers for the same resilience, and everything streams, so file size is bounded by your disk rather than memory. Files organize into upload buckets with retention you control: expire after a set time (up to weeks) or after a one-time download, with automatic cleanup when links lapse. Recipients need nothing installed - they open the link, preview files in modal views, and grab everything as a zip or tar.gz archive with one click. Buckets can be password-protected (AES-encrypted download lists), and security-through-obscurity is done properly: bucket URLs use hashed UUID tokens and stored filenames are replaced with UUIDs. An optional admin page (enabled by setting an admin password) lists bucket information and storage. The Vue.js frontend ships under 100 KB gzipped and is fully responsive. Honest caveat from the author: no end-to-end payload encryption yet. BSD-licensed, Docker-ready.

The Bitwarden server, reimplemented in Rust: Vaultwarden (formerly bitwarden_rs) is the unofficial lightweight edition. It speaks the same wire protocol as the official server, so every official Bitwarden client - browser extensions, iOS, Android, desktop, and the bw CLI - connects without modification, while the server itself runs as a single container against SQLite (or MySQL/MariaDB/PostgreSQL) instead of the official multi-container stack that wants gigabytes of RAM. Features Bitwarden gates behind paid tiers ship free: organizations with collections, groups, member roles, and policies; TOTP code storage; file attachments; Bitwarden Send; Emergency Access; event logs; and admin password reset. Two-factor options cover authenticator apps, email, FIDO2 WebAuthn, YubiKey, and Duo, and OIDC-based SSO landed natively in v1.35.0. Zero-knowledge encryption is unchanged - vault data is encrypted client-side and the master password never reaches the server. Attachments and Sends store on local disk or S3-compatible backends, an admin panel manages users and server settings, and backup is copying one data directory. Suited to individuals and teams up to roughly 50 users.

SilentSuite is an end-to-end encrypted sync service for your calendar, contacts, and tasks, where the server stores only ciphertext and cannot read a single event, name, or plan. Encryption happens on your devices with keys derived locally, so record contents are sealed before upload and opened only on another trusted device of yours. Manage everything in the web app, sync a phone through the Android adapter's system calendar, contacts, and task providers, or connect desktop apps like Thunderbird and GNOME Calendar through the local Bridge. The Bridge speaks CalDAV and CardDAV only on localhost, then forwards encrypted records upstream, so standard desktop clients work without ever exposing plaintext to the server. Import and export keep exit paths open, and because sync rides the open Etebase protocol, your data model stays inspectable rather than locked into a proprietary format. Self-hosting unlocks every feature at no cost: one Compose file starts the sync server and PostgreSQL, with open registration you can close after your own account exists, nightly backup tooling, and Umbrel packaging. Signing up hosted users is not required at all; the same web app, Android adapter, and Bridge run against your own server with your domain. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 8,000 GitHub stars and continuous development since 2020, LibrePhotos delivers the core intelligence of Google Photos — face recognition, object detection, semantic search, and automatic album generation — entirely on your own hardware without sending a single photo to a third-party server. The Django 5 backend processes uploaded media through a machine learning pipeline that runs face detection via the face_recognition library, clusters identified faces using scikit-learn and HDBSCAN, generates image captions through BLIP and Moondream 2, and classifies scenes using Places365 or Google's SigLIP 2 vision-language model with zero-shot classification against 900+ real-world tags. Semantic search lets you find photos by natural language queries like "sunset at the beach" without manual tagging, while metadata search filters by person, camera, lens, file type, and filesystem path. The React 18 frontend built with Vite presents a timeline view, fullscreen lightbox with slideshow mode, photo detail sidebar showing location and people, and a folder navigation view with breadcrumb paths. RAW files from any camera are converted via ImageMagick, videos processed through FFmpeg, and Live Photos paired with their RAW+JPEG counterparts as unified entries. Public album sharing via link provides fine-grained privacy controls, and duplicate detection uses perceptual hashing to identify near-identical images. Deployment runs as a single unified Docker container or via Docker Compose with Kubernetes manifests also available. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Securo is a privacy-first personal finance platform that keeps all your financial data in your own PostgreSQL instance while connecting to 2,500+ banks across three continents for automated transaction sync. The FastAPI backend with React/TypeScript frontend deploys via Docker Compose on ports 3000 and 8000, with Redis-backed Celery workers handling background synchronization. Bank connections span approximately 2,500 European PSD2 institutions through Enable Banking across 29 countries, US and international banks via SimpleFIN's open protocol, and Brazilian banks through Pluggy, all refreshing automatically every four hours. Multi-account management tracks checking, savings, credit cards, and investments with running balances. The auto-categorization rules engine applies pattern-matching across merchants and amounts. Goal tracking monitors savings targets with progress visualization, asset management handles stocks and custom instruments with configurable valuation growth rules, and reports generate Net Worth and Income vs Expenses charts with category sparklines. Optional AI Agents provide LLM chat with tool-use over your financial data through MCP, supporting OpenAI, Anthropic, Ollama, and compatible providers with per-agent RAG knowledge bases accessible via a global command palette. Multi-user support includes OIDC login, passkey authentication, TOTP two-factor, privacy mode, and multi-currency FX conversion via Open Exchange Rates. 1,500+ stars since March 2026. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Paaster is the pastebin for snippets too sensitive for a public paste site: every paste is encrypted in your browser before upload, so the server only ever stores ciphertext it cannot read. Paste code or logs and the text is sealed with libsodium the moment you stop typing, with the secret riding in the link fragment that browsers never send to a server. Share the link and only its holder can open the paste; share it as a QR code, or beam it to your other device with a five-minute code using Send to device. Set a paste to delete after its first view or after a chosen time, protect it with an access code, and let automatic language detection syntax-highlight the result. Your own pastes stay browsable in a local history, themes and keyboard shortcuts keep the editor fast, and drag-and-drop file sharing works the same encrypted way. Upload from the terminal with the companion CLI or the REST API, and store everything in MongoDB with MinIO, S3, or Cloudflare R2 holding the encrypted blobs. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Built as a direct rejection of the adtech model, Plausible is the best-known privacy-first web analytics tool - lightweight, cookie-free, and open-source. It sets no cookies and stores no personal data: unique visitors are counted via a hash of IP plus User-Agent that rotates every 24 hours and is never stored raw, so no consent banner is required and GDPR compliance is structural rather than contractual. The tracking script is under 1 KB - orders of magnitude lighter than GA - and the dashboard is a deliberate contrast to GA4's sprawl: one fast-loading page with visitors, sources, top pages, countries, devices, and UTM breakdowns, filterable by any dimension. Custom events and goals track signups and clicks, Google Search Console integration pulls in search queries, scheduled email reports keep stakeholders updated, and the Stats API (v2) plus CSV export feed data anywhere. This is the AGPL-licensed Community Edition, the same Elixir codebase that powers Plausible's cloud service, running as three containers: the web app, PostgreSQL for accounts, and ClickHouse for event storage - which means self-hosters get direct SQL access to raw analytics data the cloud version never exposes. Traffic data stays entirely on your server, with no visitor caps or per-pageview pricing.

With over 1,600 GitHub stars and a design philosophy that fundamentally rethinks how time tracking should work, Traggo abandons the traditional project-task hierarchy that forces your work into rigid categories and instead lets you tag time spans with arbitrary key-value pairs — project:website, type:coding, client:acme, billable:yes — enabling cross-dimensional analysis that conventional trackers cannot replicate. The Go backend compiles into a single binary that runs alongside a SQLite database and embedded web UI in under 10MB total, consuming approximately 50MB of RAM at runtime and starting in seconds on even the smallest VPS. Tags are the fundamental data model: create any tag key with any set of values, then apply multiple tags to each time span simultaneously to track by project, client, task type, energy level, or any other dimension your workflow demands. Customizable dashboards render pie charts, bar charts, and line graphs from tag-aggregated data, letting you visualize time distribution across any combination of dimensions over configurable date ranges. The calendar view displays time spans as colored blocks across days and weeks, while the list view provides chronological entry browsing with inline editing. Multiple themes including light and dark modes adapt the interface to personal preference, and simple user management with role-based access supports small team deployments. Docker deployment runs a single container exposing port 3030 with multi-architecture support for amd64, arm64, and arm v7. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Telegram Desktop's export is a file you make once by hand; Telegram Archive is a self-hosted backup that keeps saving your chats on a schedule and in real time, then lets you read them in a viewer that looks like Telegram. After one login with the code Telegram sends you, it stores messages, photos, videos, voice notes, stickers, documents, and link previews, saving each file once even when several chats share it. A live listener captures new messages, edits, and reactions as they happen, and a daily full pass fills any gaps. Every edit keeps its earlier text as a version, and with deletion tracking switched on, deleted messages stay in the archive marked as deleted. The viewer offers folders, forum topics, archived chats, pinned messages, polls, shared media, and search across every chat, plus a What changed feed of deletions, edits, and transcripts. Voice notes can be transcribed into searchable text by a server you run or rent. Family or colleagues get logins limited to chosen chats, or a share link that opens a single chat. One archive holds several accounts, a Telegram Desktop export can be imported for older history, and twelve themes suit phones and desktops. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0-or-later licensed.

What Nitter was to Twitter and Invidious is to YouTube, Lingva Translate is to Google Translate: a privacy front-end delivering the service's full capability while cutting Google out of the loop between you and your text. Built on Next.js with TypeScript and Chakra UI, it uses the purpose-built Lingva Scraper to fetch translations from Google Translate without your browser ever touching a Google-related service - no cookies, no tracking, no account, while retaining what makes Google Translate hard to give up: 100+ languages with the translation quality of Google's production models, unlike offline engines that trade privacy for accuracy. The clean interface covers automatic source-language detection, text-to-speech audio playback for pronunciations, definitions and examples, and light/dark themes. For developers, every instance doubles as a translation API: a RESTful endpoint at /api/v1/:source/:target/:query returns JSON translations, an audio endpoint serves TTS buffers, and a full GraphQL API at /api/graphql exposes translations, audio, and language lists for richer integrations - all unmetered on your own instance. Deployment is a single stateless container with one environment variable for the site domain; defaults for theme and language pair are configurable. GPL-licensed, and popular as the translation backend for privacy-respecting apps.

The ad-riddled "free online tools" sites people paste sensitive text into and upload confidential PDFs to - OmniTools replaces that whole ecosystem with one self-hosted app. It bundles 50+ utilities behind one clean React/TypeScript interface: image tools (resize, convert, crop, edit), video and audio tools (trim, reverse, convert), PDF tools (split, merge, edit), text and list utilities (case converters, formatters, shufflers), plus date/time, math, and data-format helpers for JSON, CSV, and XML. The architectural decision that makes it trustworthy is that all file processing happens entirely client-side in the browser - the server only serves static assets, and nothing you process ever leaves your device. That design has a pleasant side effect: the host needs almost no resources (people run it on a Raspberry Pi Zero), because your browser does the work while the server just delivers files. The Docker image is a remarkable 28 MB, making it one of the fastest apps to deploy and cheapest to keep running. There are no ads, no tracking, no accounts, and no upload limits. With multi-language support and an MIT license, it works equally well as a personal toolbox or a team-wide internal utility portal - one URL that replaces a bookmark folder full of questionable converters. Actively developed with 50 contributors and 9,500+ GitHub stars.

Mailflow gathers every mailbox you own, the work account, the personal one, and the address stranded at a provider you left years ago, into one unified inbox hosted on your own server. All accounts merge into a single stream sorted by date, then sort themselves into Primary, Newsletters, Social, Notifications, and Other tabs, with a reclassify button for the ones that land wrong. Conversations group into threads, one click unsubscribes from detected newsletters, and full-text search reaches across every connected account at once. Writing mail gets a proper editor with formatting, tables, emoji, attachments, and smart address completion that learns from what you send, while inbox rules and a block list quietly move, archive, star, or trash messages by sender, subject, or content before you ever see them. New mail arrives with real-time toasts and push notifications, the interface installs as an app, speaks eleven languages, and can be reshaped with layouts, themes, and your own CSS. Accounts stay protected with two-factor authentication and single sign-on, contacts sync out over CardDAV, and an optional AI assistant can summarize a thread or draft the reply you are avoiding. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.